https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-18T10:02:58.715681+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2025-06616 bdu:2025-06616 2026-10-18T10:02:58.720688+00:00 bdu:2025-06616 https://cve.radiocsirt.org/vuln/bit-superset-2025-48912 BIT-superset-2025-48912 — Apache Superset: Improper authorization bypass on row level security via SQL Injection 2026-10-18T10:02:58.720723+00:00

Affected: Bitnami: superset

An authenticated malicious actor using specially crafted requests could bypass row level security configuration by injecting SQL into 'sqlExpression' fields. This allowed the execution of sub-queries to evade parsing defenses ultimately granting unauthorized access to data.

This issue affects Apache Superset: before 4.1.2.

Users are recommended to upgrade to version 4.1.2, which fixes the issue.

 https://cve.radiocsirt.org/vuln/euvd-2026-242280 EUVD-2026-242280 2026-10-18T10:02:58.720758+00:00 EUVD-2026-242280 https://cve.radiocsirt.org/vuln/fkie_cve-2025-48912 fkie_cve-2025-48912 2026-10-18T10:02:58.720772+00:00

An authenticated malicious actor using specially crafted requests could bypass row level security configuration by injecting SQL into 'sqlExpression' fields. This allowed the execution of sub-queries to evade parsing defenses ultimately granting unauthorized access to data.

This issue affects Apache Superset: before 4.1.2.

Users are recommended to upgrade to version 4.1.2, which fixes the issue.

 https://cve.radiocsirt.org/vuln/ghsa-8w7f-8pr9-xgwj GHSA-8w7f-8pr9-xgwj — Apache Superset: Improper authorization bypass on row level security via SQL Injection 2026-10-18T10:02:58.720794+00:00

Affected: PyPI: apache-superset

An authenticated malicious actor using specially crafted requests could bypass row level security configuration by injecting SQL into 'sqlExpression' fields. This allowed the execution of sub-queries to evade parsing defenses ultimately granting unauthorized access to data.

This issue affects Apache Superset: before 4.1.2.

Users are recommended to upgrade to version 4.1.2, which fixes the issue.

 https://cve.radiocsirt.org/vuln/pysec-2026-1164 PYSEC-2026-1164 — Apache Superset: Improper authorization bypass on row level security via SQL Injection 2026-10-18T10:02:58.720816+00:00

Affected: PyPI: apache-superset

An authenticated malicious actor using specially crafted requests could bypass row level security configuration by injecting SQL into 'sqlExpression' fields. This allowed the execution of sub-queries to evade parsing defenses ultimately granting unauthorized access to data.

This issue affects Apache Superset: before 4.1.2.

Users are recommended to upgrade to version 4.1.2, which fixes the issue.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2025-1168 WID-SEC-W-2025-1168 — Apache Superset: Schwachstelle ermöglicht SQL Injection 2026-10-18T10:02:58.720836+00:00

Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Apache Superset ausnutzen, um eine SQL Injection durchzuführen, und somit Daten zu manipulieren.